wechat-cli-local-data
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill requires administrative execution (
sudoon macOS/Linux and elevated terminals on Windows) to initialize the tool and scan process memory for database encryption keys. Additionally, it automates or instructs the forced re-signing of the WeChat application with thecom.apple.security.get-task-allowentitlement, lowering the application's native protections against debugging and injection. - [EXTERNAL_DOWNLOADS]: The installation guidelines prompt the download of unverified software packages across multiple registries, including the npm package
@canghe_ai/wechat-cli, the PyPI packagewechat-cli, and a GitHub repository from an unrelated third-party account (freestylefly). - [COMMAND_EXECUTION]: The skill relies extensively on executing external CLI binaries (
wechat-cli) to access local files, sessions, configurations, and chat databases. - [INDIRECT_PROMPT_INJECTION]: The skill reads untrusted external data (WeChat messages, contact bios, group chat logs) and feeds it into the agent's context, exposing the system to potential multi-step or tool-output injection payloads.
- Ingestion points: Incoming data streams through commands like
wechat-cli history,wechat-cli search, andwechat-cli new-messagesinSKILL.md. - Boundary markers: Absent; no specific delimiters or instruction safety guards are defined to segregate chat text from system instructions.
- Capability inventory: The tool runs local binary execution workflows via the shell.
- Sanitization: Absent; no parsing or validation safeguards are defined to strip executable or instructional code blocks from chat transcripts.
Audit Metadata